Idig Dns

net.softricksPublished by softricks.netOfficial publisherv1.0.0Updated Oct 24, 2026

Professional DNS diagnostics: 14 tools for DNS, DNSSEC, email security, SSL, and propagation.

VerifiedSSEWeb executableWeb Search & ScrapingCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server exposing 19 DNS diagnostic tools so an assistant can look up records, audit email security, validate DNSSEC and check SSL certificates.

What you can do
Look up DNS records of any type and run resolution diagnostics, including a combined diagnose tool for outages and a propagation check across 16 global resolvers, plus TTL and zone consistency checks and an AXFR vulnerability test. Audit email security with SPF, DKIM, DMARC and BIMI grading, MX health and provider detection, and IP blacklist checks. Validate DNSSEC with chain-of-trust results, key and signature health, and DANE/TLSA cross-validation against the live certificate. Inspect domains and hosting: WHOIS data, registrar lock and EPP status, geolocation, ISP, ASN and CDN detection, subdomain discovery, SSL certificate details and HTTP/HTTPS reachability.
When to use it
Useful when troubleshooting DNS or mail delivery problems, checking whether DNS changes have propagated, auditing a domain's email and DNSSEC posture, or reviewing certificates, subdomains and blacklist status before a migration or security review.
Requirements
A remote SSE endpoint; the README suggests connecting through the mcp-remote bridge with npx, so Node.js is needed for that route. Every tool requires a token parameter, obtained from the provider's API documentation site. Network access to the provider's endpoint is required.
Before you install
All tools require a token parameter, which the README's example prompts show being typed into chat alongside the domain; treat it as a secret and avoid pasting it into shared conversations. Queries about a domain, including subdomain discovery and blacklist checks, are sent to the provider's API and onward to live DNS infrastructure and third-party resolvers and blocklists.

Installation

In SourceWeft

  1. Open Idig Dns in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via SSE. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/net.softricks%2Fidig-dns/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "idig-dns": {
      "type": "sse",
      "url": "https://mcp.softricks.net/sse"
    }
  }
}

README

iDig DNS MCP Server

A remote MCP server exposing 19 professional DNS diagnostic tools from the iDig API — built by Kedar Bhave ( Softricks ).

Connect any MCP-compatible AI client (Claude Desktop, Cursor, Windsurf, and more) to real DNS infrastructure. Diagnose outages, audit email security, validate DNSSEC, check SSL certificates, trace propagation across 16 global resolvers, and more — all in plain English.

Live endpoint: https://mcp.softricks.net/sse

Quickstart

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "idig-dns": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.softricks.net/sse"      ]    }  }}

Restart Claude Desktop. You'll see idig-dns appear under Connectors.

Cursor / Windsurf

Add to your MCP settings:

json
{  "mcpServers": {    "idig-dns": {      "command": "npx",      "args": [        "mcp-remote",        "https://mcp.softricks.net/sse"      ]    }  }}

Authentication

All tools require a token parameter. Get your token at api.softricks.net/idig/docs.

Tools

ToolDescription
dns_lookupLook up any DNS record type: A, AAAA, MX, NS, TXT, SOA, CAA, SRV, CNAME, DS, TLSA, HTTPS, SVCB
resolve_checkResolution diagnostics — returns ok / nxdomain / servfail / timeout / degraded
diagnoseFull diagnosis combining resolution + DNSSEC — start here when something is broken
email_security_auditSPF, DKIM, DMARC, and BIMI audit with A–F grade and prioritized fix recommendations
mx_checkMX health + provider detection (Google Workspace, M365, Proofpoint, 35+ providers)
dnssec_validateDNSSEC chain of trust — returns secure / insecure / bogus / indeterminate
dnssec_healthKey inventory, signature expiry, algorithm assessment, rollover readiness
propagation_checkCheck propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia
ssl_checkCertificate validity, expiry countdown, domain match, issuer, chain completeness
ttl_checkTTL advisory with step-by-step migration lowering plan
zone_consistencyCompare all authoritative nameservers — catches lame delegation and SOA mismatches
subdomain_discoverProbe 75 common subdomains + crt.sh Certificate Transparency logs — surfaces exposed dev/staging environments
geo_lookupGeolocation, ISP, ASN, CDN detection, hosting flag
domain_statusEPP registrar lock status — transfer-ready, delete lock, serverHold, pendingDelete
blacklist_checkIP blacklist / DNSBL check — Spamhaus, Barracuda, SpamCop, SORBS, and more
whois_lookupParsed WHOIS data — registrar, expiry, domain age, nameservers, EPP status
http_checkHTTP/HTTPS reachability — status codes, redirect chain, HSTS, HTTP→HTTPS redirect
zone_axfrAXFR zone transfer vulnerability check — tests if any NS allows public zone transfers
dane_validateDANE/TLSA validation — cross-validates TLSA records against live TLS certificate

Example prompts

My emails are going to spam for example.com — token is YOUR_TOKEN
Did my DNS changes propagate yet for example.com? token: YOUR_TOKEN
Run a full security audit on example.com, token YOUR_TOKEN
Is the SSL cert for example.com about to expire? token YOUR_TOKEN
We're migrating example.com to a new host next week — are the TTLs safe? token YOUR_TOKEN
What subdomains does example.com have exposed? token YOUR_TOKEN
Are any of example.com's IPs on a blacklist? token YOUR_TOKEN
Get WHOIS info for example.com — token YOUR_TOKEN
Is example.com reachable over HTTPS? token YOUR_TOKEN
Check if example.com is vulnerable to zone transfers — token YOUR_TOKEN
Validate DANE/TLSA records for example.com — token YOUR_TOKEN

Architecture

Claude Desktop / Cursor / Windsurf        │        │  MCP over SSE        ▼mcp.softricks.net          ← Railway (always-on Python/FastMCP server)        │        │  HTTPS        ▼api.softricks.net/idig     ← AWS Lambda (iDig REST API)        │        │  DNS queries        ▼Live DNS infrastructure

Self-hosting

Clone this repo and deploy your own instance:

bash
git clone https://github.com/kbhave/MCP-Service-iDigcd MCP-Service-iDigpip install -r requirements.txtpython mcp_server.py

Or deploy to Railway in one click — connect your GitHub repo and Railway handles the rest.

Requirements:

  • Python 3.11+
  • mcp==1.26.0
  • httpx

Related

License

MIT

Source: README.md at commit 1c2cd4f

Tools

19

dns_lookup

Look up DNS records for a domain. Record types: a, aaaa, ns, mx, txt, soa, caa, srv, cname, ds, tlsa, https, svcb, any, all.

Parametersrrtokenrequireddomainrequired

email_security_audit

Full SPF, DKIM, DMARC, and BIMI audit with A-F grade and prioritized fix recommendations.

Parameterstokenrequireddomainrequired

dnssec_validate

Validate DNSSEC chain of trust. Returns: secure / insecure / bogus / indeterminate.

Parameterstokenrequireddomainrequired

dnssec_health

DNSSEC health report: key inventory, signature expiry, algorithm assessment, DS at parent, rollover readiness, full chain of trust (Root → TLD → Domain) with chain_intact flag and broken-link identification, warnings, and recommendations.

Parameterstokenrequireddomainrequired

resolve_check

DNS resolution diagnostics. Returns status: ok / nxdomain / nodata / servfail / refused / timeout / degraded.

Parameterstokenrequireddomainrequired

diagnose

Full diagnosis combining resolution + DNSSEC. Use first when something is broken.

Parameterstokenrequireddomainrequired

propagation_check

Check DNS propagation across 16 global resolvers: Google, Cloudflare, Quad9, China, Korea, Russia.

Parameterstokenrequireddomainrequiredrecord_type

mx_check

MX health + provider detection: Google Workspace, M365, Proofpoint, Zoho, 35+ providers.

Parameterstokenrequireddomainrequired

domain_status

Registrar lock and EPP status. Checks transfer lock, delete lock, serverHold, pendingDelete.

Parameterstokenrequireddomainrequired

geo_lookup

Geolocation and hosting: country, city, ISP, ASN, CDN detection, is_hosting flag.

Parameterstokenrequireddomainrequired

ttl_check

TTL advisory: flags dangerous TTLs and gives step-by-step migration lowering plan.

Parameterstokenrequireddomainrequired

zone_consistency

Check all authoritative nameservers return identical answers. Catches lame delegation and SOA mismatches.

Parameterstokenrequireddomainrequired

ssl_check

SSL certificate: validity, expiry countdown, domain match, issuer, chain completeness.

Parameterstokenrequireddomainrequired

subdomain_discover

Discover subdomains by probing 75 common names plus crt.sh Certificate Transparency logs. Surfaces exposed dev/staging environments.

Parameterstokenrequireddomainrequired

blacklist_check

IP blacklist / DNSBL check. Tests A-record and MX IPs against Spamhaus, Barracuda, SpamCop, SORBS, and more.

Parameterstokenrequireddomainrequired

whois_lookup

Parsed WHOIS: registrar, creation/expiry dates, domain age, nameservers, EPP status, DNSSEC status.

Parameterstokenrequireddomainrequired

http_check

HTTP/HTTPS reachability: status codes, redirect chain, HSTS header, HTTP→HTTPS redirect detection.

Parameterstokenrequireddomainrequired

zone_axfr

AXFR zone transfer vulnerability check. Tests whether any authoritative NS allows public zone transfers (critical misconfiguration).

Parameterstokenrequireddomainrequired

dane_validate

DANE/TLSA validation: cross-validates TLSA DNS records against the live TLS certificate. Supports all four TLSA usage types.

Parametersporttokenrequireddomainrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.